Requirements
API01 - Broken object-level authorization